Data Processing Agreement (DPA)

This English version is provided for convenience only. The Romanian version (Acord de prelucrare a datelor (DPA)) is the legally binding one and prevails in case of any discrepancy.

Version 1.2 · Last updated: 14 October 2026 · Effective from: 11 octombrie 2026

This agreement is concluded pursuant to Art. 28 of Regulation (EU) 2016/679 ("GDPR"). It forms an integral part of the e-gata Terms and Conditions and is accepted upon activation of the subscription.

1. Parties and roles

• Controller: the Customer who activated the subscription (the name and CUI shown on the pro forma invoice).
• Processor: Secure IT Solutions SRL, tax identification number (CUI) RO20624157, registered office at Str. Pescărușului nr. 4, bl. D4, sc. B, et. 4, ap. 29, Sector 2, București, which operates e-gata.ro ("e-gata").

e-gata processes, as processor, the personal data that visitors to the Customer's website submit via the website's forms (including, on the Growth package, by keeping the enquiries from the contact form in the CRM installed on the Customer's website) and, on the Growth package, via the chatbot or via the lead forms in the managed advertisements. The processing is carried out exclusively on behalf of the Customer and on the basis of its instructions.

The agreement does not cover the data of the Customer's representatives, which e-gata processes as controller, in accordance with the Privacy Policy.

2. Description of the processing

3. e-gata's obligations

e-gata undertakes:

1. to process the data only on the basis of the Customer's documented instructions: this agreement, the configuration of the forms and requests by email, including those concerning transfers outside the EEA. If an instruction infringes the GDPR, e-gata informs the Customer;
2. to ensure that persons authorised to process the data are bound by confidentiality;
3. to apply the security measures in Annex 1 (Art. 32 GDPR);
4. to comply with the conditions for engaging sub-processors (section 5);
5. to assist the Customer in responding to data subjects' requests (access, rectification, erasure, restriction, portability, objection). Requests received directly by e-gata are forwarded to the Customer without delay, within 5 working days at the latest;
6. to assist the Customer with security, breach notification, data protection impact assessment and prior consultation (Art. 32–36 GDPR), taking into account the nature of the processing;
7. to notify the Customer without undue delay and within 48 hours at the latest of becoming aware of a personal data breach, with the information available: the nature of the incident, the categories and approximate number of data subjects, the likely consequences and the measures taken. Further information is provided as it becomes available;
8. to delete the data processed on behalf of the Customer within 30 days at the latest of termination of the contract, unless the law requires them to be retained. At the Customer's request made before termination, e-gata returns the data in a common format (CSV or JSON). The enquiries in the CRM (Growth) are kept until the end of the 30 days following termination: during this period the Customer may request their export in CSV, and at the end they are deleted;
9. to make available to the Customer the information necessary to demonstrate compliance with Art. 28 GDPR and to allow reasonable audits: with at least 30 days' prior notice, no more than once a year, at the Customer's expense and without access to other customers' data. A written report, with answers to a security questionnaire, may replace an on-site audit;
10. not to use the data for its own purposes, including for training artificial intelligence models.

4. The Customer's obligations

The Customer:

1. determines the legal basis for the processing and informs visitors through the privacy policy of its website. e-gata provides a template, which the Customer reviews and adapts;
2. is responsible for the lawfulness of the instructions and of the data it decides to collect;
3. responds to data subjects' requests, with e-gata's assistance;
4. uses the data received from visitors in accordance with the GDPR. For example, it does not use them for marketing without a legal basis;
5. if it requests analytics or marketing cookies on its website, accepts the display of a consent banner configured by e-gata.

5. Sub-processors

5.1. The Customer grants a general authorisation for the sub-processors listed in Annex 2.

5.2. e-gata informs the Customer by email of any addition or replacement at least 15 days in advance. The Customer may object, giving reasons, within this period. If no solution is found, the Customer may terminate the contract without penalties, including during the minimum term of the package, without owing the remaining months, and receives the unused portion of the paid month. 5.3. e-gata imposes on sub-processors data protection obligations equivalent to those in this agreement and is liable to the Customer for their acts.

6. Transfers outside the EEA

e-gata processes and stores the data primarily in the EEA. If a sub-processor listed in Annex 2 involves a transfer outside the EEA, the transfer is made only on the basis of an adequacy decision (including the EU-US Data Privacy Framework, for certified providers) or of the European Commission's standard contractual clauses (SCCs) (Decision (EU) 2021/914).

7. Liability

Liability for damage caused by an infringement of the GDPR is determined in accordance with Art. 82 GDPR. As between the parties, the limitations in the Terms apply, to the extent permitted by law.

8. Term

The agreement applies for the term of the contract and, after termination, until the data are deleted or returned (section 3 point 8).

---

Annex 1: Technical and organisational measures (Art. 32 GDPR)

Confidentiality

• Encrypted HTTPS/TLS 1.2+ connections for websites, forms and administration panels.
• Access to systems only for authorised persons, with strong authentication (SSH keys, two-factor authentication) and on the principle of least privilege.
• Form messages are sent to the Customer by email and are kept in e-gata's systems only for the period set out in section 2.
• The CRM (Growth) is accessible only over HTTPS, with an account and password created for the Customer; each Customer has its own CRM, on its own website, with no access to other customers' data.
• e-gata's own servers are located in Romania. The website generator runs in isolation, in a separate container, and is exposed only through a secure tunnel (Cloudflare Tunnel).

Integrity and availability

• Regular security updates.
• Regular, encrypted backups, with tested restoration.
• Anti-spam and anti-abuse protection on forms (Cloudflare Turnstile, rate limiting).
• Logging of administrative access.

Minimisation and deletion

• Forms ask only for the necessary fields.
• Automatic deletion when the retention period ends (90 days for forms, 7 days for the chatbot); data in the CRM is deleted 30 days after termination of the contract.
• Internal notifications are sent by email, through e-gata's own email server (mail.e-gata.ro), hosted by the provider listed in Annex 2; we do not use third-party messaging apps for them.

Organisational

• Confidentiality obligation for every person with access.
• Incident response procedure, with notification of the Customer within 48 hours.
• Procedure for data subjects' requests.
• Annual review of the measures.

Annex 2: Authorised sub-processors

The updated list is published on this page. Changes are announced in accordance with section 5.